(RHCSA) Manage Security

This is part of the independent and unofficial RHCSA Exam Study Guide series providing free 🤑 resources for prepare for the exam.

This post covers the objectives under the section:

“MANAGE SECURITY”

It contains two main parts:

• Resources: with links to learn and practice for each objective.
• Cheatsheet: containing some examples of commands and actions performed in each objective (when applied).

📚 Resources:

CONFIGURE FIREWALL SETTINGS USING FIREWALL-CMD/FIREWALLD

(This objective is also covered in: “manage basic networking / restrict network access using firewall-cmd/firewall”)

• 📌 RHCSA v8 Practice Session: Configure firewall settings using firewall-cmd/firewalld

• 📌 An introduction to firewalld rules and scenarios

• 📌 Chapter 51. Using and configuring firewalld

• 📌 Using firewalld

• 📌 How to Restrict Network Access Using FirewallD

• 📌 How To Set Up a Firewall Using FirewallD on CentOS 8

CREATE AND USE FILE ACCESS CONTROL LISTS

• 📌 RHCSA v8 Practice Session: Create and use file access control lists

• 📌 An introduction to Linux Access Control Lists (ACLs)

• 📌 Enjoy Better Flexibility in Granting File System Permissions with Access Control Lists (ACLs)

• 📌 Secure Files/Directories using ACLs (Access Control Lists) in Linux

• 📌 How to configure Access Control Lists (ACLs) on Linux

• 📌 Chapter 5. Access Control Lists

CONFIGURE KEY-BASED AUTHENTICATION FOR SSH

• 📌 RHCSA v8 Practice Session: Configure key-based authentication for SSH

• 📌 Using ssh-keygen and sharing for key-based authentication in Linux

• 📌 Passwordless SSH using public-private key pairs

• 📌 SSH Public Key Authentication

SET ENFORCING AND PERMISSIVE MODES FOR SELINUX

• 📌 What is SELinux?

• 📌 SELinux Coloring Book

• 📌 About SELinux

• 📌 RHCSA v8 Practice Session: Set enforcing and permissive modes for SELinux

• 📌 How to Disable or set SELinux to Permissive mode

• 📌 Chapter 1. Getting started with SELinux

• 📌 Chapter 2. Changing SELinux states and modes

LIST AND IDENTIFY SELINUX FILE AND PROCESS CONTEXT

• 📌 RHCSA v8 Practice Session: List SELinux file and process context / Restore default file contexts

• 📌 How to List All SELinux Contexts

• 📌 Understanding SELinux File Labelling and SELinux Context

• 📌 7. SELinux Contexts – Labeling Files

• 📌 Four semanage commands to keep SELinux in enforcing mode

• 📌 4.1. Customizing the SELinux policy for the Apache HTTP server in a non-standard configuration

RESTORE DEFAULT FILE CONTEXTS

• 📌 RHCSA v8 Practice Session: List SELinux file and process context / Restore default file contexts (at 19:30)

USE BOOLEAN SETTINGS TO MODIFY SYSTEM SELINUX SETTINGS

• 📌 RHCSA v8 Practice Session: Use boolean settings to modify system SELinux settings

• 📌 Understanding SELinux Booleans

• 📌 Managing SELinux Policy with Booleans (setsebool)

• 📌 How to Enable or Disable SELinux Boolean Values

• 📌 Linux security: Manipulating SELinux policies with Booleans

• 📌 4.6. Booleans

• 📌 Four semanage commands to keep SELinux in enforcing mode

DIAGNOSE AND ADDRESS ROUTINE SELINUX POLICY VIOLATIONS

• 📌 Chapter 5. Troubleshooting problems related to SELinux

• 📌 Basic SELinux Troubleshooting in CLI

• 📌 How to read and correct SELinux denial messages

• 📌 SELINUX: Diagnose and address routine SELinux policy violations

📑 Cheatsheet:

CONFIGURE FIREWALL SETTINGS USING FIREWALL-CMD/FIREWALLD

• firewall-cmd --list-services --zone public, cat /etc/firewalld/zones/public.xml ➡ list allowed services for specific zone.

• firewall-cmd --reload ➡ apply changes.

• firewall-cmd --add-port "8000-8005/udp" --zone trusted --permanent ➡ permanently allow protocol on specified port range on trusted zone.

• firewall-cmd --panic-on ➡ start panic mode, blocking any access from outside.

• firewall-cmd --zone=drop --add-source=192.168.122.191/24 ➡ add determined ip to drop zone wich drop packets.

• firewall-cmd --zone=drop --remove-source=192.168.122.191/24 ➡ remove determined ip from drop zone.

• firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.122.33 drop' ➡ add rich rule to drop packets from determined ip.

• firewall-cmd --state, systemctl status firewalld ➡ check if the service is enabled and active.

• firewall-cmd --get-default-zone ➡ display default zone name.

• firewall-cmd --get-active-zones ➡ display active zones.

• firewall-cmd --get-zones ➡ display all available zones.

• firewall-cmd --set-default-zone=home ➡ set default zone to home.

• firewall-cmd --list-all ➡ display information about the defualt zone.

• firewall-cmd --list-all --zone=home ➡ display information about home zone.

• firewall-cmd --list-all-zones ➡ list all zones.

• firewall-cmd --list-services ➡ list allowed services in the current zone.

• firewall-cmd --list-ports ➡ list allowed ports in the current zone.

• firewall-cmd --zone=public --list-services ➡ list allowed services for the specific zone.

• Permanently add a Port to a zone:

  • firewall-cmd --add-port 443/tcp --zone=public --permanent ➡ add port to public zone.

  • firewall-cmd --reload ➡ reload to apply the changes.

• Permanently add a Service to a zone:

  • firewall-cmd --add-service=httpd --zone=public ➡ add port to public zone.

  • firewall-cmd --runtime-to-permanent ➡ make changes persist.

• firewall-cmd --change-interface=enp7s0 --zone=home --permanent ➡ change specified interface to specified zone.

CREATE AND USE FILE ACCESS CONTROL LISTS

• setfacl -m u:user100:6 file1, setfacl -m u:user100:rw file1 ➡ gives user100 read and write permissions on file1 by using Access Control Lists (ACLs).

• setfacl -dm u:user100:7,u:user200:rwx projects/ ➡ allocate default rwx permissions to user100 and user200 on projects/ dir.

• setfacl -m m:r file1 ➡ set mask limitiation to only read access on file1.

• getfacl file1 -c ➡ display ACL properties for file1 and omit headers.

• setfacl -x u:user100 file1 ➡ removes any user100 ➡ ACL permissions for file1.

• setfacl -k projects/ ➡ deletes default ACL permissions for projects/ directory.

• setfacl -b file1 ➡ resets ACL permissions for file1.

CONFIGURE KEY-BASED AUTHENTICATION FOR SSH

• ssh-keygen ➡ start ssh key generator on interactive mode.

• ssh-keygen -N "" -q ➡ generate RSA keys without password, on silent mode.

• ssh-copy-id server20 ➡ copy current user’s public key to server20.

• On /etc/ssh/sshd_config set PermitRootLogin no ➡ disallow root login via ssh, needs sshd to be restarted.

• tail /var/log/secure ➡ view ssh remote access logs (ssh server).

SET ENFORCING AND PERMISSIVE MODES FOR SELINUX

• getenforce ➡ displays current mode of operation.

• setenforce permissive ➡ switch the operating mode to permissive temporarily.

• Edit /etc/selinux/config file ➡ to permanently switch SELinux operating mode (survive reboots).

• seinfo -u ➡ (requires setools-console) list SELinux users.

• semanage login -l ➡ show mapping between Linux user and SELinux user.

• semanage port -l ➡ list records of the port object type.

• sestatus ➡ shows SELinux runtime status and Boolean values.

LIST AND IDENTIFY SELINUX FILE AND PROCESS CONTEXT

• ls -Z ➡ the Z flag available for some commands as id, ps, ls) allows to view SELinux context.

• ps auxZ | grep -e http -ei label ➡ show detailed info about all http named processes running (diplaying ps header).

• semanage fcontext -l | grep /var/www/html ➡ display SELinux file contexts for files and dirs whose path contains /var/www/html .

• chcon -vu user_u -t public_content_t dir1 -R ➡ temporarily modify SELinux user and type on the directory dir1 recursively.

• Change file context permanently:

  • ls -ldZ ➡ verifiy SELinux context for the directory.

  • semanage fcontext -a -s user_u -t public_content_t '/dir1(/.*)?' ➡ add dir1 recursively to the policy database.

  • restorecon -Rv dir1 ➡ recursively restore default context on files by referencing the files in the /etc/selinux/targeted/contexts/files directory. It relabels, apply the changes.

  • ls -ldZ ➡ verifiy applied changes.

• man semanage-fcontext ➡ see man page for fcontext subcommand.

• semanage fcontext -Cl ➡ list recent changes in the policy database.

• --preserve=context ➡ this flag available for cp command allows to copy preserving SELinux context for the object.

• semanage port -at http_port_t -p tcp 8010 ➡ add port 8010 with type http_port_t and protocol tcp, to the policy.

• semanage port -d -p tcp 8010 ➡ delete port 8010 with protocol tcp from the policy.

RESTORE DEFAULT FILE CONTEXTS

• Use restorecon to restore file contexts changed temporarily by using chcon command! To restore default file contexts changed permanently on files/dirs, semanage fcontext -D must be used!

• Reset file context permanently:

  • ls -ldZ ➡ verifiy SELinux context for the directory.

  • semanage fcontext -D '/dir1(/.*)?' ➡ delete all local customizations por specified directory, recursively.

  • restorecon -Rv dir1 ➡ apply changes.

  • ls -ldZ ➡ verifiy applied changes.

USE BOOLEAN SETTINGS TO MODIFY SYSTEM SELINUX SETTINGS

• getsebool -a, sestatus -b, semanage boolean -l ➡ list SELinux boolean state.

• setsebool nfs_export_all_rw 0 ➡ temporarily set nfs_export_all_rw boolean to off.

• setsebool -P nfs_export_all_rw 0 ➡ persistently set nfs_export_all_rw boolean to off.

DIAGNOSE AND ADDRESS ROUTINE SELINUX POLICY VIOLATIONS

• sealert -a /var/log/audit/audit.log && sealert -a /var/log/messages ➡ Display SELinux policy violations.

• journalctl -t setroubleshoot ➡ see alert provided by systemd journal.

• ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent ➡ use ausearch tool to query Audit logs.

• sealert -l 97a1c0df-81ed-4c08-ba27-41c5067b713b ➡ Display alert event.

• grep 1415714880.156:29 /var/log/audit/audit.log | audit2why ➡ use audit2why tool to help adressing an issue.

• matchpathcon -V /var/www/html/* ➡ check the context and compare it to the default label for this path.

Next:

(RHCSA) Manage Containers

…or back to Red Hat Certified System Administrator (RHCSA) Exam Study Guide

Useful links & references:

• Red Hat Enterprise Linux Documentation

• Enable Sysadmin (a blog from Red Hat)

Footnotes:

• Follow me on Twitter to get more posts like this and other quick tips in your feed.
• If you have any doubts or tips about this article, I’d appreciate knowing and discussing it via email.
• Do you have any other Linux tips? Would you like to publish that in this blog? Please send an email to all drops.
• As English is not my native language, I apologize for the errors. Corrections are welcome.
• Contact: contact [@] alldrops [.] info.